如何通过HTTP请求获取用户X.509证书-（无SSL）

Question

We would like to authenticate/authorize users using X.509 certificates and groups within LDAP.

With Tomcat 5.5 we were able to do this by getting the X.509 cert over SSL and then switching back to http and continue to use the userPrincipal in the request. Moving to Tomcat 6 and 7 the userPrincipal is no longer available after switching back to http.

In this question Can I use SSL certificate without using a HTTPS connection? It is said that you can request the X.509 cert without SSL. I'm trying to confirm if it is possible and if anyone has an idea how that could be done.

Answer 1

Let's think about this for a second.

User authentication usually goes like this:

1. Ask the client to prove his identity
2. Receive proof of the user identity
3. Pass back a unique random string that the client can use to prove his identity in the future (session token).

Going back to unencrypted HTTP after authentication is a bad idea. Everybody can see the session token on the wire. They can steal it and use it to pose as the user. See FBController or search on "session hijack" for an example.

Using an unencrypted session to pass the proof of user identity is an equally bad idea. Everybody can replay this and pose as the user. Whether you use an X.509 certificate or a username/password: it is all the same thing.

If you really really want, you could implement your own pseudo-HTTPS using Javascript. Yahoo for example used JavaScript to take a salted SHA1 of the user password before sending it over the wire. You could use Javascript to sign a nonce using the private key of the X.509, and also send over the public certificate. Beware that you are still open to session hijacking when using this method, so it is only a false sense of security!

A much much better way is to just use standard HTTPS. The full connection is encrypted, which means there are no confidentiality issues with passing the user proof, session hijacking or even viewing the information requested by the user.